PT-2025-4763 · Sonicwall · Sonicwall Netextender

Published 2025-01-30 · Updated 2025-02-04 · CVE-2025-23007

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SonicWall NetExtender versions up to 10.3.0

Description A vulnerability in the NetExtender Windows client log export function allows unauthorized access to sensitive Windows system files, potentially leading to privilege escalation.

Recommendations For SonicWall NetExtender versions up to 10.3.0, update to a version later than 10.3.0 to resolve the issue. As a temporary workaround, consider restricting access to the log export function to minimize the risk of exploitation.

Fix

LPE

Improper Privilege Management

Incorrect Default Permissions

Weakness Enumeration

CWE-269

CWE-276

Related Identifiers

CVE-2025-23007

Affected Products

Sonicwall Netextender

References · 9

• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0005 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-23007 · Security Note
• https://twitter.com/CVEnew/status/1884908033341333812 · Twitter Post
• https://twitter.com/autumn_good_35/status/1885323506092826833 · Twitter Post
• https://t.me/cvenotify/109138 · Telegram Post
• https://twitter.com/WolfgangSesin/status/1884926992409104615 · Twitter Post
• https://t.me/cvedetector/16748 · Telegram Post
• https://t.me/cvenotify/109160 · Telegram Post
• https://twitter.com/CCBalert/status/1886691830009327939 · Twitter Post